LUFITOSite-to-site VPN · Remote access · One gateway
The bank wants a VPN tunnel before they’ll connect you.
Lufito is the gateway that gives you one — and the next one, and the one after that. Every client, every partner and every device kept apart by default, on a server you own.
Each client gets its own address range the moment it is created. The firewall is built from that inventory on every apply, so a client that has not been granted something cannot reach it — including by accident.
What it is for
Three jobs, one box, no network team
Most businesses meet this problem sideways. A partner integration stalls, staff can’t reach the office, or a piece of equipment turns out to speak a protocol from 2009.
A partner demands a tunnel
Banks, insurers and payment processors will not put your traffic on the public internet. They send a parameter sheet and expect IKEv2 with matching proposals. Lufito answers it, and the next one, from the same gateway.
Your people are not in the office
Laptops and phones join by WireGuard — a phone is set up by scanning one code. Servers get a split tunnel that routes only what they need, so nothing else about them changes.
Equipment that cannot keep up
A PBX or an old appliance that speaks only OpenVPN still joins its owner’s network, under the same rules as everything else. Nothing gets an exemption for being old.
The part that matters
Sharing a gateway should not mean sharing a network
The cheap way to run many clients on one box is to put them all on the same network and hope nobody goes looking. It works until it doesn’t, and you find out from the client.
Lufito builds its firewall from the client inventory every time it applies. Each client has its own address range. A rule exists only where access has been granted, and everything else meets a closing deny.
Traffic crossing a tunnel is governed twice more: one list for what you may start with a partner, another for what they may start with you. Both are empty until somebody writes a line, so a new tunnel comes up carrying nothing at all.
That has a consequence worth stating plainly. If part of the inventory cannot be read, the devices it describes are simply absent from the rules — and absent means denied. A fault costs connectivity, never separation.
# each client reaches its own -s 10.242.1.0/24 -d 10.242.1.0/24 RETURN -s 10.242.2.0/24 -d 10.242.2.0/24 RETURN # and its own tunnel, nobody else's -s 10.242.1.0/24 -o ipsec1 RETURN -s 10.242.2.0/24 -o ipsec2 RETURN # everything else -d 10.242.0.0/16 DROP -o ipsec+ DROP
Specification
Boring, current cryptography
Chosen to negotiate with equipment that is already in the field, rather than to look modern on a slide.
Site to site
- Protocol
- IKEv2, strongSwan
- Phase 1
- AES-256, SHA-256, DH group 14
- Phase 2
- ESP, AES-256, SHA-256, PFS
- Per tunnel
- own interface, own address, own rules
- Dead peers
- detected and restarted
Remote access
- Protocol
- WireGuard, dual stack
- Setup
- one QR code, or a config file
- Servers
- split tunnel, only the routes they need
- Fallback
- OpenVPN for appliances
- Revocation
- immediate, per device
Operating it
- Console
- web, reachable only over the VPN
- Accounts
- per client, scoped server-side
- Passwords
- scrypt, sessions revocable
- Record
- every change, with who and when
- Also
- a command line that does everything
Nothing proprietary and no vendor extensions — standard IKEv2 with proposals mainstream gateways already accept, so the other end does not have to be Lufito.
Where it runs
On your server, with your keys
Lufito installs onto a plain Ubuntu machine — your own hardware, or a virtual server from any provider. There is no Lufito cloud in the middle, no account to depend on, and no third party holding the keys to your partners.
The installer refuses rather than guesses: it will not run where the kernel cannot carry a tunnel, and it will not take an address range that collides with something already routed.
If you would rather not run it yourself, Sihebs operates it for you on the same terms.
$ sudo ./install.sh --dry-run checking kernel, python, addresses… ok xfrm and wireguard available ok 10.242.0.0/16 is free ok udp 500, 4500, 51820 admitted $ sudo ./install.sh done gateway ready $ lufito device add crm --tenant cl_04 created crm at 10.242.4.2
Who it is for
Businesses with partners, not network departments
Microfinance and lending
Core banking links, credit bureau connections, and a branch network that has to reach both without either seeing the other.
Health and insurance
Claims integrations with several funds at once, where each counterparty expects its own tunnel and its own terms.
Call centres and BPO
Phone systems that must reach a customer’s CRM, and agents who need the office network from wherever they are working.
Anyone integrating with a bank
If a parameter sheet has landed in your inbox and nobody in the building knows what a proposal is, this is the shortest way to answer it.
Pricing
You pay for tunnels, not for people
A tunnel is real work — parameters to agree with somebody else’s network team, and an evening spent working out which of you is refusing phase 2. Laptops and phones are not, so we stop charging for those early.
Tanzanian shillings, excluding VAT. Add the lines you actually need — there is no tier to outgrow, and nothing withheld to make a larger one look better.
The gateway
The gateway itself, the web console, monitoring, and up to ten remote devices for staff, servers or phones. Everybody needs this line, and needs it only once — a second tunnel does not want a second gateway.
Each site‑to‑site tunnel
One partner, one branch, or one data centre. Add a line for each. They run alongside one another on the same gateway and still cannot see each other.
Remote devices past the tenth
Counted per device rather than per person, so somebody with a laptop and a phone is two. Most companies never reach this line at all.
Gateway hosted in Tanzania
For when a regulator, a partner’s policy or a latency budget requires the gateway to sit inside the country. Quoted against the facility, so ask before assuming you need it.
Commissioning a tunnel
Reading the parameter sheet your partner sent, agreeing the proposals with their engineers, configuring the router at your end, and proving that traffic reaches a service you name. Half on order, half the day it carries that traffic.
Installed on your own server
Lufito on your hardware or your own virtual machine, with your keys and nothing of ours in the middle, handed over with a support arrangement. Priced against the size of the estate.
Worked example
A lender connecting one partner
- One tunnel to the core banking provider
- Six laptops and a phone system
- Console access for their own IT staff
Worked example
An insurer with three funds
- Three tunnels, one for each counterparty
- Twenty devices across two branches
- Every fund walled off from the other two
Pay yearly, get two months
Settle twelve months up front and pay for ten. Most clients do, on the grounds that the alternative is raising a purchase order every month for the rest of time.
The setup fee is split on purpose
Half when you order, half the day the tunnel carries traffic to the service you named. If that day never comes, the second half is never due.
Changes are not billed by the hour
New rules, new devices, key rotation, and somebody to call when a tunnel drops at an inconvenient hour are inside the monthly figure rather than beside it.
Month to month
Thirty days’ notice and no minimum term on the monthly plan. The configuration is yours, and it leaves with you.
Tell us who you need to reach
Send us the parameter sheet your partner gave you, or just describe the problem. We will tell you what it takes — including when the answer is that you don’t need us.
- info@sihebs.co.tz
- Phone
- +255 756 532 635
- +255 796 296 796
- Web
- www.sihebs.co.tz
Victoria House, 5th Floor, Wing B
Plot 37, Regent Estate, New Bagamoyo Road
P. O. Box 33073, Dar es Salaam, Tanzania